Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation

A China-affiliated hacking group conducted a sustained multi-wave cyberattack against an Azerbaijani oil and gas company from December 2025 to February 2026, repeatedly exploiting the same Microsoft Exchange vulnerability.

• •FamousSparrow (UAT-9244) exploited the ProxyNotShell vulnerability chain to gain initial access
• •Deed RAT (a ShadowPad successor) and TernDoor backdoors were deployed across three separate attack waves
• •An advanced DLL side-loading technique leveraging the LogMeIn Hamachi binary was used to execute malware while evading defenses
• •Lateral movement and redundant footholds were established to ensure persistence despite remediation attempts

This summary was automatically generated by AI based on the original article and may not be fully accurate.